Databases are having a moment — and not always a comfortable one. Tailscale spent six months chasing a recurring corruption bug before landing a fix inside SQLite itself, a sixteen-year-old bug hiding in plain sight. If that makes you feel better about your own incident timelines, PlanetScale's write-up on Postgres subtransactions will undo that: past 64 subtransactions, throughput drops from 7,200 TPS to 160 — a cliff nobody put on the map. On the upside, Michael Malis rebuilt the Postgres query engine with SIMD and operator fusion to get 300x analytics gains, and Shopify quietly replaced Redis with MySQL for inventory reservations using SKIP LOCKED for ACID guarantees — proof that sometimes the boring choice is the correct one.
The AI and security angle is uncomfortably lively. Simon Willison assembled the full timeline of how OpenAI's agents accidentally hammered Hugging Face, which reads like a cautionary tale about autonomous infra-probing at scale. Stolen Thoughts takes it further: encrypted reasoning traces, replayed into jailbroken sibling models, leaked keys, tokens, and PII across over 315,000 decoded blocks. And Matteo Collina describes triaging 20–40 AI-generated security reports a week as a maintainer — the pushback threshold has to go up or OSS maintainers will drown.
On the tooling front: pnpm 12 is a Rust rewrite with only three behavioural differences from pnpm 11 — respectably compatible for a ground-up rewrite. Docker Sandboxes runs coding agents in their own microVMs with a Docker daemon inside, solving isolation and reproducibility at once. Hunk is a terminal diff viewer built specifically for reviewing agent-written code, and njsscan 1.0 brings zero-config SAST to Node.js with about 70 semgrep rules out of the box. Finally, revision prompting makes the case for giving LLMs an input diff and asking for a patch instead of a rewrite — a small workflow change with real downstream payoff.
Enjoy!
Signup here for the newsletter to get the weekly digest right into your inbox.
Find the 12 highlighted links of weeklyfoo #150:
How Tailscale tracked down a 16-year-old SQLite bug
by Tailscale
Six months of recurring database corruption, ending in a fix inside SQLite itself.
🚀 Read it!, databases, debugging
Now we have a timeline of the OpenAI accidental attack against Hugging Face
by Simon Willison
Full breakdown of how OpenAI agents probing infrastructure ended up hammering Hugging Face, with the internal timeline of what happened.
📰 Good to know, security, ai
Triaging the AI Horde
by Matteo Collina
A maintainer on sorting real security bugs from 20-40 AI-written reports a week, and why the pushback threshold has to go up.
📰 Good to know, security, oss
We replaced Redis with MySQL for inventory reservations and it scaled
by Shopify
Shopify moved reservations to MySQL with SKIP LOCKED for ACID guarantees and fewer oversells on peak days.
📰 Good to know, database, mysql
Revision prompting improves industrial LLM processes
by Revision Prompting
Feed the model the original input, its original output and the input diff, then ask for a patch instead of a rewrite.
📰 Good to know, ai, llm
Stolen thoughts
by Stolen Thoughts
Encrypted reasoning traces replayed into jailbroken sibling models leaked keys, tokens and PII across 315,320 decoded blocks.
📰 Good to know, security, ai
The dangers of Postgres subtransactions
by PlanetScale
Past 64 subtransactions throughput fell from 7,200 TPS to 160, and new read replicas refuse connections.
📰 Good to know, postgres, performance
Rebuilding Postgres for 300x faster analytics
by Michael Malis
Batching, operator fusion and SIMD in a query engine, from the creator of pgrust.
📰 Good to know, postgres, performance
Docker Sandboxes
by Docker
Run coding agents in their own microVMs with a Docker daemon inside.
🧰 Tools, ai, docker
pnpm 12, the Rust rewrite
by pnpm
Release candidate with only three behavioural differences from pnpm 11.
🧰 Tools, tooling, pnpm
njsscan 1.0
by Ajin Abraham
Zero-config SAST for Node with around 70 semgrep rules for XSS, SSRF, eval, JWT and NoSQL injection.
🧰 Tools, security, nodejs
Hunk
by Ben Vinegar
A terminal diff viewer built to make reviewing agent-written code manageable.
🧰 Tools, cli, review
Want to read more? Check out the full article here.
To sign up for the weekly newsletter, visit weeklyfoo.com.
Top comments (0)